Privacy Policy

1. Information We Collect

We collect only the information necessary to provide our grading services:

• Teacher/School Information: Name, email address, account credentials.
• Student Information: Uploaded exams, student names (if visible), AI-generated scores and feedback.
• Usage Data: Teacher exam upload dates, usage statistics.
• Payment Information: Processed securely via Stripe (no card data stored by us).
• Cookies: For authentication and essential analytics.

We do not knowingly collect information directly from students or minors. Student data is uploaded only by authorized teachers or schools.

2. How We Use Information

We use collected information solely to:

• Deliver, support, and improve grading services.
• Authenticate user accounts and manage access.
• Generate scores and feedback from uploaded exams.
• Fulfill transactions and maintain billing (via Stripe).
• Improve platform reliability through aggregated, anonymized analytics.

We do not use student data for targeted advertising, profiling, or marketing.

3. Data Protection & Security

We maintain industry-standard and education-specific security practices:

• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Access Controls: Row-Level Security ensures teachers/schools can only access their own data. Role-based permissions restrict system access.
• Audit Logs: Maintained at the application and infrastructure level (Supabase + Google Cloud).
• Cloud Infrastructure: Supabase (database/storage) and Vercel (app hosting) with private buckets.

4. Student Data & Educational Records

• We treat uploaded student exams as educational records under FERPA.
• We act as a "school official" with a legitimate educational interest, processing data solely on behalf of schools and districts.
• AI Processing: Student exam data may be processed using third-party AI and cloud service providers acting solely on our behalf. These providers are contractually prohibited from retaining, training on, or using student data for advertising, profiling, or any purpose other than delivering the requested educational services.
• Rubric Generation: Rubrics may be automatically generated to support grading using third-party AI services acting on our behalf. This processing is performed solely for educational purposes and is subject to the same student data protections described in this policy.

5. Data Retention & Deletion

• Default retention: Student exam data is stored up to 6 months after the last teacher activity.
• Custom retention: Schools/districts may set shorter timelines by contract.
• Deletion:
  • Teachers/districts may request deletion at any time.
  • Accounts inactive for 6 months are scheduled for deletion, with 30-day notice.
  • We do not maintain backup storage. Deleted data is permanently and immediately removed from our systems.

6. Third-Party Services

We use vetted third-party service providers ("subprocessors") to operate and support the platform, including for database hosting, authentication, payments, web hosting, and AI-powered features.

All subprocessors act solely on our behalf and are contractually bound to maintain strong privacy, confidentiality, and security practices consistent with this policy and applicable education privacy laws.

7. Breach Notification

If a breach involving personal or student data occurs, we will notify affected schools and/or teachers promptly, and no later than 72 hours after discovery, in accordance with FERPA and applicable state laws.

8. Privacy Rights

• Teachers may request access, correction, or deletion of their data.
• Schools/districts may request export or deletion of all student data.
• Parents, through their school, may request access to or deletion of student records (FERPA).
• Requests can be made at support@mathgrader.ai.

9. Policy Updates

We may update this policy as laws or practices change. If material changes are made, we will notify schools and teachers by email and/or platform notice.

10. Contact Us

For questions or privacy-related requests: